[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Recommendation for Key Management_ Part 1 – General:

3.3.1 Communications versus Storage ... 3.3.1                                                                                | Public Authentication Keys... 3.3.1 Communications versus Storage

Keys that are used for confidentiality protection of communication exchanges may often have shorter cryptoperiods than keys used for the protection of stored data.

Recommendation for Key Management_ Part 1 – General


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Research Report_ User Perceptions of Smart Home Privacy and Security provide? (Part 5)

[Assistant] | 17 | | | 3.2.8 | Device Hacking | 17 | | | 3.2.9 | Physical Safety | 18 | | | 3.2.10 | Other Security Concerns | 19 | | | 3.2.11 | Lack of Concern | 19 | | | 3.2.12 | Risk Acceptance | 20 | | 3.3 | Mitigations | Mitigations | 20 | | 4 Conclusion | 4 Conclusion | 4 Conclusion | 22 | | References | References | References | 22 | | List of Tables | List of Tables | List of Tables | List of Tables | | Table 1 Participant demographics | Table 1 Participant demographics | Table 1 Participant demographics | 4 | | Table 2 Privacy and security mitigations | Table 2 Privacy and security mitigations | Table 2 Privacy and security mitigations | 21 | | List of Figures | List of Figures | List of Figures | List of Figures | | Fig.

Research Report_ User Perceptions of Smart Home Privacy and Security

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to A Review of U.S. and European Security Evaluation Criteria:

The Orange Book forms the basis upon which the National Computer Security Center (NCSC) conducts its commercial computer security evaluation process. This process is focused on commercially produced and supported general-purpose operating system products that meet the needs of government departments and agencies. The evaluation is aimed at off-the-shelf products and is completely separate from any considerations of overall system performance, potential applications, or processing environments. The evaluation can provide a key input to a computer system security approval /accreditation . However, it does not constitute a complete computer system security study. A complete study must consider additional factors dealing with the system in its unique environment, such as its proposed security mode of operation, specific users, applications, data sensitivity, physical and personnel security, administrative security and communications security

Part II describes a number of additional security services (e.g., communications integrity, denial of service, transmissions security) that arise in conjunction with networks. The full range of physical and administrative security measures appropriate to the highest sensitivity level of information on the network must be in place in order to operate a trusted network as described in the Red Book

The Red Book does not describe all the security requirements that may be imposed on a network. Depending upon the particular environment, there may be communications security, physical security, and other measures required.

A Review of U.S. and European Security Evaluation Criteria


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0:

|                                                                                | • NIST SP 800-53 Rev.
4 AU-4, CP-2, SC-5 • CCS CSC 17                                                                                |
|            |                                                                                | PR.DS-5: Protections against data leaks are implemented                                                          | • COBIT 5 APO01.06 • ISA 62443-3-3:2013 SR 5.2 • ISO/IEC 27001:2013 A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3 • NIST SP 800-53 Rev. 4 AC-4, AC-5, AC-6, PE-19, PS-3, PS-6, SC-7, SC-8, SC-13, SC-31, SI-4 |
|            |                                                                                | PR.DS-6: Integrity checking mechanisms are used to verify software, firmware, and information integrity          | • ISA 62443-3-3:2013 SR 3.1, SR 3.3, SR 3.4, SR 3.8 • ISO/IEC 27001:2013 A.12.2.1, A.12.5.1, A.14.1.2, A.14.1.3 • NIST SP 800-53 Rev.

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Key Performance Indicators for Process Control System Cybersecurity Performance Analysis provide? (Part 5)

[Assistant]
...................10                        | 4. Measurement Methodologies...............................................................................................10                        | 4.
Measurement Methodologies...............................................................................................10                        |                                                                                |
| 4.1. | 4.1. | Manufacturing Process Performance...............................................................................11                                   |                                                                                |
| 4.2. | 4.2. | Network Performance......................................................................................................12                          |                                                                                |
| 4.3. | 4.3. | Computing Resources Performance.................................................................................12                                   |                                                                                |
| 4.4. | 4.4. | Industrial Protocol Performance......................................................................................13                              |                                                                                |
| 4.5. | 4.5. | OPC Data Exchange Performance...................................................................................14                                   |                                                                                |
| 5. Appendix A -- References ....................................................................................................15                   | 5.

Key Performance Indicators for Process Control System Cybersecurity Performance Analysis

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2:

3.5.1] with the following changes:

1.

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to A Review of U.S. and European Security Evaluation Criteria:

* Division D; Minimal Protection -This division contains only one class. It is reserved for those systems that have been evaluated but that fail to meet the requirements for a higher evaluation class.
* Division C: Discretionary Protection -Classes in this division provide discretionary (need-to-know) protection and, through the inclusion of audit capabilities, accountability of subjects and the actions they initiate.
* Division B; Mandatory Protection -The concept of a security relevant or Trusted Computing Base (TCB) that preserves the integrity of sensitivity labels and uses them to enforce a set of mandatory access control rules

is a major requirement of this division. Systems in this division must carry the sensitivity labels with major data structures in the system. The system developer also provides the security policy model on which the TCB is based and furnishes a specification of the TCB. Evidence must be provided to demonstrate that the reference monitor, an access control concept that refers to an abstract machine that mediates all accesses to objects by subjects, has been implemented. The security kernel, the hardware, software and firmware elements of a TCB, must mediate all accesses to data, be protected from modification, and be verifiable as correct.

The Orange Book addresses two types of access control discretionary and mandatory. Discretionary access control (DAC) is the weaker of the two. It provides a means of restricting access to objects based on the identity of subjects and/or groups to which they belong. The controls are discretionary in the sense that a subject with a certain access permission is capable of passing that permission, directly or indirectly, to any other subject. The TCB of Division C systems includes provisions for DAC. This type of access protection is vulnerable to Trojan horse attack and can result in security problems related to inappropriate or unauthorized sharing of objects.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines on Electronic Mail Security provide? (Part 2)

[Assistant]
y, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-45 Version 2 Natl. Inst. Stand. Technol. Spec. Publ. 800-45 Version 2, 139 pages (Feb.
2007)

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. ## Acknowledgements, Version 2

The authors, Wayne Jansen and Karen Scarfone of NIST, Miles Tracy of Federal Reserve Information Technology, and Jason Butterfield of Booz Allen Hamilton, wish to express their thanks to colleagues at both organizations who reviewed drafts of this document. In particular, their appreciation goes to Linda Antil, Rick Ayers, Bill Burr, Tim Grance, and Tim Polk from NIST for their research, technical support, and written contributions to this version of the document. The authors would also like to express their thanks to all those who contributed input during the public comment period and who assisted with our internal review process. ## Acknowledgements, Original Version

The authors, Wayne Jansen of NIST and Scott Bisker and Miles Tracy of Booz Allen Hamilton (BAH), wish to express their thanks to colleagues at both organizations who reviewed drafts of this document. In particular, their appreciation goes to John Wack, Murugiah Souppaya, and Tim Grance from NIST, and Steve Allison, Alexis Feringa, Jonathan Holleran, Kevin Kuhlkin, and Mark McLarnon from BAH, for their research, technical support, and written contributions to this document. The authors would also like to express their thanks to all those who contributed input during the public comment period and who assisted with our internal review process.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to U.S. Department of Justice Simplified Risk Analysis Guidelines:

- a. A risk analysis may be defined as an analysis of the threats to and vulnerabilities of a system, expected losses, and selection of countermeasures to reduce the losses to an acceptable level. The requirement for Federal agencies to conduct a risk analysis of an Automated Data Processing (ADP) facility has been in effect since the issuance of the Office of Management and Budget (OMB) Circular A-71, Transmittal Memorandum No. 1 in 1978. The Department of Justice (DOJ) issued Order DOJ 2640. 2B and its earlier canceled versions which established the requirement for a risk analysis of DOJ ADP facilities beginning in 1977. The DOJ also issued a detailed risk analysis guidance document for use by DOJ ADP facilities in 1977. A number of Federal agencies, contractors, and university professors have developed risk analysis methodologies, some of which have been automated. Due to the complexity of the risk analysis process, the methodologies generally require considerable time to become knowledgeable of its correct usage and to complete the risk analysis. - b. A risk analysis does not enhance security by itself but provides cost effective security recommendations for management consideration. Therefore, there is a need to simplify the risk analysis process to the extent possible, which is the intent of the Simplified Risk Analysis Guidelines (SRAG) contained herein. The SRAG expedites the risk analysis process for the system under evaluation by initially determining if minimum security requirements applicable to the DOJ are met, which eliminates a number of threats and losses from evaluation. Although the SRAG simplifies the risk analysis process, SRAG users should be aware that significant effort by knowledgeable personnel may be required to complete a risk analysis.

U.S. Department of Justice Simplified Risk Analysis Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Foundations of a Security Policy for Use of the National Research and Educational Network:

## Foundations of a Security Poiicy for Use of the- Nationai Research and Educationai Network

## Foundations of a Security Policy for Use of the National Research and Educational Network

Security has become a topic of national importance as more and more information is being processed in distributed computer systems and networks. This report explores some underlying considerations in the development of a security policy for the evolving National Research and Education Network (NREN).

Foundations of a Security Policy for Use of the National Research and Educational Network


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

3.1.2                                                                                | Time Spent on Security Awareness ... 3.1.2 Time Spent on Security Awareness

## Focus Groups

The focus group demographic survey asked what percentage of time participants spend on their security awareness duties.

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Computer Security Division 2007 Annual Report provide?

[Assistant] ## Computer Security Division 2007 Annual Report <!-- image --> ## TAble of ConTenTS | Welcome | 1 | |--------------------------------------------------------------------------|-----| | Division Organization | 2 | | The Computer Security Division Responds to the | | | Federal Information Security Management Act of 2002 | 3 | | Security Management and Assistance | 4 | | FISMA Implementation Project | 4 | | Publications | 7 | | Outreach and Awareness | 11 | | Health Information Technology | 15 | | Security Testing and Metrics | 17 | | Validation Programs and Laboratory Accreditation | 17 | | Cryptographic Validation Standards | 20 | | Security Technology | 22 | | Cryptographic Standards Toolkit | 22 | | Response to Quantum Computing | 24 | | Authentication | 25 | | Security Aspects of Electronic Voting | 25 | | Systems and Network Security | 26 | | Identity Management | 26 | | Research in Emerging Technologies | 30 | | Automated Vulnerability Management and Measurement | 33 | | Infrastructure Services, Protocols, and Applications | 37 | | Biometrics | 44 | | CSD's Role in National and International IT Security Standards Processes | 47 | |

Computer Security Division 2007 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Computer Security Division 2012 Annual Report:

|
| Security Outreach and Integration Group................ | 5                                              |
| Security Testing, Validation, and Measurement Group...
| 6                                              |
| The Computer Security Division Implements the Federal Information Security Management Act of 2002......................................................7 |                                                |
| CSD's Programs/Projects for FY2012..................8                                                                                |                                                |
| CSD Work in National and International Standards.....

Computer Security Division 2012 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IR.L2-3.6.2 (NIST 3.6.2)?

[Assistant]
According to Automation Support for Security Control Assessments_ Volume 1_ Overview:

3.6.2 Many Controls Support Multiple Capabilities... 3.6.2 Many Controls Support Multiple Capabilities

Most control items support more than one capability.

Automation Support for Security Control Assessments_ Volume 1_ Overview


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

gement, administrative, technical,
and physical standards and guidelines for the cost-effective security and privacy of other
than national security-related information in federal information systems.
The Special
Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in
information system security, and its collaborative activities with industry, government,
and academic organizations.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines on Mobile Device Forensics provide? (Part 5)

[Assistant]
ochester Institute of Technology and Daren Melson for their assistance on technical issues that arose in our work. The authors would also like to thank all others who assisted with our review process.
| Table of Contents                                                                                | Table of Contents                                                                                | Table of Contents                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
| TABLE OFCONTENTS.............................................................................................................V         | TABLE OFCONTENTS.............................................................................................................V         |                                                                                |
| LIST OF FIGURES....................................................................................................................VII | LIST OF FIGURES....................................................................................................................VII |                                                                                |
| LIST OFTABLES....................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Program Review for Information Security Management Assistance (PRISMA) provide?

[Assistant]
## NISTIR 7358

## Program Review for Information Security Management Assistance (PRISMA)

Pauline Bowen Richard Kissel

<!-- image -->

## NISTIR 7358

## Program Review for Information Security Management Assistance (PRISMA)

## Pauline Bowen Richard Kissel

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD  20899-8930

January 2007

<!-- image -->

U.S. Department of Commerce Carlos M. Gutierrez, Secretary

Technology Administration

Robert Cresanti, Under Secretary of Commerce for Technology

National Institute of Standards and Technology William Jeffrey, Director

## Reports on Information Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) has the broad mission of supporting U.S. industry, government, and academia by promoting U.S. innovation and industrial competitiveness through advancement of information technology measurement science, standards, and technology in ways that enhance economic security and improve our quality of life. ITL researchers have developed detailed protocols and operational standards that improve safety of their operation, and established assessment criteria and test data sets for validation of industrial products. ITL formulates metrics, tests, and tools for a wide range of subjects such as information complexity and comprehension, high confidence software, space-time coordinated mobile and wireless computing, as well as, issues of information quality, integrity, and usability. Under the Federal Information Security Management Act, ITL is directed to develop cyber security standards, guidelines, and associated methods and techniques. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of non national-securityrelated information in federal information systems.

Program Review for Information Security Management Assistance (PRISMA)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide to Cyber Threat Information Sharing:

| Type of Threat Information | Examples of Sensitive Data Elements 9 | Recommendations | |------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Network Indicators | Any single network indicator can be sensitive, but network indicators in the aggregate are often more sensitive because they can reveal relationships between network entities.

Guide to Cyber Threat Information Sharing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Awareness and Training?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Cybersecurity Framework Profile for Liquefied Natural Gas:

| Category........................................................................................................................................23 |
| Table 22.
CSF Subcategory Priorities for the Identify Function's Business Environment (ID.BE) Category........................................................................................................................................23        |                                                                                |
| Table 23. CSF Subcategory Priorities for the Identify Function's Governance (ID.GV) Category. .......................................................................................................................................................24 |                                                                                |
| Table 24. CSF Subcategory Priorities for the Identify Function's Risk Assessment (ID.RA) Category........................................................................................................................................24             |                                                                                |
| Table 25. CSF Subcategory Priorities for the Identify Function's Risk Management Strategy (ID.RM)                                                                                | Category..........................................................................................................................25               |
| Table 26. CSF Subcategory Priorities for the Identify Function's Supply Chain Management (ID.SC) Category.

Cybersecurity Framework Profile for Liquefied Natural Gas


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to 2017 NIST_ITL Cybersecurity Program Annual Report:

No doubt that is because every year brings more troubling reports of organizations experiencing financial and reputational damage from both novel and well-known threats and vulnerabilities. But what does not get nearly as much attention are the impressive advances that so many organizations have been making in thoughtfully and successfully securing their information and processes and the systems upon which those organizations, their leaders, and their customers depend. This  report  features  some  of  our  most  significant  accomplishments  during  Fiscal  Year  (FY)  2017  in  risk management,  cryptography,  identity  and  access  management,  vulnerability  management,  education  and workforce development, and internet and communications infrastructure, as well as our efforts to transition our work into common practice. Below are just a few highlights of the work carried out in 2017. - NIST improved two widely used guidelines that provide senior leaders with the information they need to make risk-based decisions affecting critical mission and business functions. We proposed revisions to Security and Privacy Controls for Information Systems and Organizations (Special Publication (SP) 800-53) and Risk Management Framework for Information Systems and Organizations (SP 800-37). The latter provides a closer link between risk management processes and activities at various organizational levels. It demonstrates how the Cybersecurity Framework can be implemented using established Risk Management Framework processes. Both publications will be finalized in 2018.

2017 NIST_ITL Cybersecurity Program Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Information System Security Best Practices for UOCAVA-Supporting Systems:

IT systems used to provide these functions face a variety of threats.  If IT systems are not selected, configured and managed using security practices commensurate with the importance of the services they provide and the sensitivity of the data they handle, a security compromise could carry consequences for the integrity of the election and the confidentiality of sensitive voter information.  Failure to adequately address threats to these systems could prevent voters from casting ballots, expose individuals to identity fraud, or even compromise the results of an election.

This document follows NISTIR 7551, A Threat Analysis on UOCAVA Voting Systems , which documents the threats to UOCAVA voting systems using electronic technologies for all aspects of the remote voting process.  While NISTIR 7551 discusses high-level security controls capable of mitigating threats, the focus of that report was identifying technologies and associated risks.  This document complements NIST 7551 by providing security best practices to help jurisdictions create UOCAVA voting systems based on security practices used in other IT applications.

There are many different ways to support UOCAVA voters, and each jurisdiction must put together its own system for such support.  This document covers some common parts of UOCAVA system architectures, and shows how to secure those parts against both normal and extraordinary threats.  The two components that are covered in most detail are Internet-based or Internet-assisted delivery of blank ballots and voter registration.

Information System Security Best Practices for UOCAVA-Supporting Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does PDA Forensic Tools_ an Overview and Analysis provide? (Part 2)

[Assistant]
nology Interagency Report 67 pages (2004)

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.
Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. ## Abstract

Digital handheld devices, such as Personal Digital Assistants (PDAs), are becoming more affordable and commonplace in the workplace. They provide highly mobile data storage in addition to computational and networking capabilities for managing appointments and contact information, reviewing documents, communicating via electronic mail, and performing other tasks. Individuals can store and process personal and sensitive information independently of a desktop or notebook computer, and optionally synchronize the results at some later time. As digital technology evolves, the capabilities of these devices also continues to improve rapidly, taking advantage of new forms of removable media, faster processors that consume less power, touch screens with higher pixel resolution, and other components designed specifically for mobile devices. When handheld devices are involved in a crime or other incident, forensic examiners require tools that allow the proper retrieval and speedy examination of information present on the device. This report gives an overview of current forensic software, designed for acquisition, analysis, reporting of data discovered on PDAs, and an understanding of their capabilities and limitations.

PDA Forensic Tools_ an Overview and Analysis


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Attribute Considerations for Access Control Systems provide? (Part 2)

[Assistant]
er statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official.
This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-205 Natl. Inst. Stand. Technol. Spec. Publ. 800-205, 42 pages (June 2019) CODEN: NSPUE2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-205

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

Attribute Considerations for Access Control Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to SRI International_ Improving the Security of Your UNIX System:

| 3           | MONITORING SECURITY                  |   25 |
|-------------|--------------------------------------|------|
| 3 . 1       | Account Security                     |   25 |
| 3.1.1       | The lastlog File                     |   25 |
| 3.1.2       | The utmp and wtmp Files              |   25 |
| 3.1.3       | The acct File                        |   26 |
| 3.2         | Network Security                     |   27 |
| 3.2.1       | The syslog Facility                  |   27 |
| 3.2.2       | The showmount Command                |   28 |
| 3.3         | File System Security                 |   29 |
| 3.3.1       | The find Comm and                    |   29 |
| 3.3. 1.1    | Finding Setuid and Setgid Files      |   29 |
| 3.3. 1.2    | Finding World-Writable Files         |   31 |
| 3 .3 . 1 .3 | Finding Unowned Files                |   31 |
| 3.3. 1.4    | Finding .rhosts Files                |   31 |
| 3.3.2       | Checklists                           |   32 |
| 3.3.3       | Backups                              |   33 |
| 3.4         | Know Your System                     |   33 |
| 3.4.1       | The ps Command                       |   33 |
| 3.4.2       | The who and w Commands               |   34 |
| 3.4.3       | The Is Command                       |   34 |
| 3.5         | Keep Your Eyes Open                  |   34 |
| 4           | SOFTWARE FOR IMPROVING SECURITY      |   35 |
| 4.1         | Obtaining Fixes and New Versions     |   35 |
| 4.1.1       | Sun Fixes on UUNET                   |   35 |
| 4.1.2       | Berkeley Fixes                       |   36 |
| 4.

SRI International_ Improving the Security of Your UNIX System


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Recommendation for Obtaining Assurances for Digital Signature Applications:

A digital signature is an electronic analogue of a written signature; the digital signature can be used to provide assurance that the claimed signatory signed the information. In addition,  a  digital  signature  may  be  used  to  detect  whether  or  not  the  information  was modified  after  it  was  signed  (i.e.,  to  detect  the  integrity  of  the  signed  data). Each signatory has a public and private key and is the owner of that key pair. The private key is used by the owner to generate a digital signature; the public key is used in the signature verification process. | Assurance of domain parameter validity   | Assurance of the arithmetic validity of the domain parameters. |
|------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Assurance of possession                  | Assurance that the owner or claimed signatory actually possesses the private signature key. |
| Assurance of public key validity         | Assurance of the arithmetic validity of the public key. |
| Assurance- signature                     | A digital signature on a private-key-possession assurance message. |
| assurance_time                           | The time at which assurance of possession is obtained. |
| Certificate                              | A set of data that uniquely identifies a key pair owner that is authorized to use the key pair, contains the owner's public key and possibly other information, and is digitally signed by a Certification Authority (i.e., a trusted party), thereby binding the public key to the owner. |
| Certification Authority (CA)             | The entity in a Public Key Infrastructure (PKI) that is responsible for issuing certificates and exacting compliance with a PKI policy.

Recommendation for Obtaining Assurances for Digital Signature Applications


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Guide for Cybersecurity Event Recovery provide?

[Assistant]
## NIST Special Publication 800-184

## Guide for Cybersecurity Event Recovery

Michael Bartock Jeffrey Cichonski Murugiah Souppaya Matthew Smith Greg Witte Karen Scarfone

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-184

C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

<!-- image -->

## NIST Special Publication 800-184

## Guide for Cybersecurity Event Recovery

Michael Bartock Murugiah Souppaya Computer Security Division Information Technology Laboratory

Matthew Smith Greg Witte G2, Inc. Annapolis Junction, MD

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-184

December 2016

<!-- image -->

U.S. Department of Commerce Penny Pritzker, Secretary

National Institute of Standards and Technology

Jeffrey Cichonski Applied Cybersecurity Division Information Technology Laboratory

Karen Scarfone Scarfone Cybersecurity Clifton, VA

## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Cloud Computing Synopsis and Recommendations:

Reliability refers to the probability that a system will offer failure-free service for a specified period of time within the bounds of a specified environment. For the cloud, reliability is broadly a function of the reliability of four individual components: (1) the hardware and software facilities offered by providers, (2) the provider's personnel, (3) connectivity to the subscribed services, and (4) the consumer's personnel. -  Legal. Consumers should investigate whether a provider can support ad hoc legal requests for: (1) eDiscovery, such as litigation freezes, and (2) preservation of data and meta-data. -  Operating Policies. Consumers should ascertain the operating policies of providers for their: (1) willingness to be subjected to external audits and security certifications, (2) incident response and recovery procedures/practices, including forensic analysis capabilities, (3) internal investigation processes with respect to illegal or inappropriate usage of IT resources, and (4) policies for vetting of privileged uses such as the provider's system and network administrators. -  Acceptable Use Policies. Consumers should ensure that all consumer personnel read and understand the provider's acceptable use policy, and negotiate an agreement for resolution of specific classes of policy violations in advance with the provider. Further, it is important that consumers know the process a priori for how disputes over possible policy violations will be resolved between themselves and the provider. -  Licensing. Consumers should ensure that both the provider and consumer properly license any proprietary software installed into a cloud. -  Patch Management.

Cloud Computing Synopsis and Recommendations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Practical Combinatorial Testing:

3.3.2 Cost Factors

Using  combinatorial  methods  to  design  test  configurations  is  probably  the  most  widely used  combinatorial  approach  because  it  is  quick  and  easy  to  do  and  typically  delivers significant  improvements  to  testing.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

'For our main enterprise network, it's computer-based training that's taken annually…But for those who don't have access to the enterprise network often for certain other networks that we might maintain,…those are physical briefings done by the ISSOs [information system security officers] to those personnel. And then they sign an acknowledgment form.' (D03)

'You've got IT security, physical security, personnel security, etc. And they have their own training requirements…It's inefficient.' (S11)

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts, practices, and methodologies may be used by federal agencies even before the completion  of  such  companion  publications. Thus,  until  each  publication  is  completed,  current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. This publication provides security and privacy control baselines for the Federal Government. There are three security control baselines (one for each system impact level-low-impact, moderate-impact, and high-impact), as well as a privacy baseline that is applied to systems irrespective of impact level. In addition to the control baselines, this publication provides tailoring guidance and a set of working assumptions that help guide and inform the control selection process.

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Computer Security Division 2006 Annual Report provide? (Part 3)

[Assistant]
00-53A, Guide for Assessing the Security Controls  in  Federal  Information  Systems ;  and  publication  of  FIPS  200, Minimum Security Requirements for Federal Information and Information Systems .
The Cryptographic Module Validation Program was expanded to include 13 laboratories in 4 countries and continues to ensure the protection of sensitive information in computer and telecommunication systems, including voice systems. Research and development efforts included security for Radio Frequency IDentification (RFID) devices and other wireless communications systems, digital forensic tools and methods, Internet security protocols, and expansion of the National Vulnerability Database. We will continue to strive to provide products and services that protect and enhance confidence in the nation's information technology systems.

Computer Security Division 2006 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Trustworthy Email:

(MP) | | MP-1 | MEDIA PROTECTION POLICY AND PROCEDURES | MP-1 | MP-1 | MP-1 | | MP-2 | MEDIA ACCESS | MP-2 | MP-2 | MP-2 | | MP-3 | MEDIA MARKING | - | MP-3 | MP-3 | | MP-4 | MEDIA STORAGE | - | MP-4 | MP-4 | | MP-5 | MEDIA TRANSPORT | - | MP-5 (4) | MP-5 (4) |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guidelines for the Secure Deployment of IPv6:

| Executive Summary................................................................................................................. | Executive Summary................................................................................................................. | Executive Summary................................................................................................................. | 1    |
|--------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------|
|                                                                                | Introduction ................................................................................................................... | Introduction ...................................................................................................................

Guidelines for the Secure Deployment of IPv6


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Automation Support for Security Control Assessments_ Software Vulnerability Management:

3.1.2                                                                                | 3. 3.1.2 Adapt Roles to the Organization

The sub-steps for adapting roles to the organization are described in this section.

Automation Support for Security Control Assessments_ Software Vulnerability Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Mobile Forensic Reference Materials_ a Methodology and Reification provide? (Part 2)

[Assistant]
nology Interagency Report 35 pages (2009)

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.
Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose . ## Abstract

This  report  concerns  the  theoretical  and  practical  issues  with  automatically  populating  mobile devices with reference test data for use as reference materials in validation of forensic tools. It describes  an  application  and  data  set  developed  to  populate  identity  modules  and  highlights subtleties involved in the process. Intriguing results attained by recent versions of commonlyused  forensic  tools  when  used  to  recover  the  populated  data  are  also  discussed. The  results indicate  that  reference  materials  can  be  used  to  identify  a  variety  of  inaccuracies  that  exist  in present-day forensic tools. Keywords: Mobile Devices, Computer Forensics, Forensic Tool Validation

## Table of Contents

| 1. | Introduction............................................................................................................................1    | Introduction............................................................................................................................1   |
|----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|
| 2.

Mobile Forensic Reference Materials_ a Methodology and Reification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems:

proposed. The software can be managed by the developers as an open-source project shared publicly using version control platforms, such as Github, or the software can be proprietary and kept private.
Development patterns can be leveraged to enable smart contract upgradability (e.g., a registry contract that points to the latest version of the main contract of the system or an interface contract that is inherited by the system and defines a set of key functions and parameters). Periodic thirdparty  audits,  automated  tests,  and  reports  can  also  be  performed  and  disclosed  to  help  assess whether the rules are properly enforced.

A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0:

| Function      | Category                                                                                | Subcategory                                                                                | Informative References                                                                                |
|---------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| IDENTIFY (ID) | Asset Management (ID.AM): The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to business objectives and the organization's risk strategy. | ID.AM-1 : Physical devices and systems within the organization are inventoried                                                                                | • CCS CSC 1 • COBIT 5 BAI09.01, BAI09.02 • ISA 62443-2-1:2009 4.2.3.4 • ISA 62443-3-3:2013 SR 7.8 • ISO/IEC 27001:2013 A.8.1.1, A.8.1.2 • NIST SP 800-53 Rev.

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.5 (NIST 3.2.5)?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1:

3.2.5 Allowed Check System Usage ... 3.2.5 Allowed Check System Usage

The following requirements and recommendations apply to the use of the <xccdf:check> and <xccdf:complex-check> elements:

1. 3.2.5.

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to National Checklist Program for IT Products_ Guidelines for Checklist Users and Developers:

ct levels, as described in FIPS 199 and SP 800-53. Developers are also encouraged to consider requirements imposed by the Health Insurance Portability and Accountability Act (HIPAA) and other sources.
| Field Name                        | Description                                                                                |
|-----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Target Operational Environment    | The IT product's operational environment, such as Standalone, Managed, or Custom (with description, such as Specialized Security-Limited Functionality, Legacy, or United States Government). Generally only applicable for security compliance/vulnerability checklists. |
| Checklist Type                    | The type of checklist, such as Compliance, Vulnerability, and Specialized.

National Checklist Program for IT Products_ Guidelines for Checklist Users and Developers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Configuration Management?

[Assistant]
According to Computer Security Division 2010 Annual Report:

systems  for  potential federal agency use: hosted a growing repository of federal agency security practices, public/private security practices, and security configuration checklists for IT products.
Con-

In  addition  to  the  above  publications,  the  division  collabo rated with the Manufacturing Engineering Laboratory at NIST in reviewing comments received and updating the draft guide to industrial control system security, NIST SP 800-82, G uide to Industrial  Control  Systems  (ICS)  Security:  Supervisory  Control and  Data  Acquisition  (SCADA)  Systems,  Distributed  Control Systems (DCS), and Other Control System Configurations Such as Programmable Logic Controllers (PLC) .

Computer Security Division 2010 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does PIV Data Model Test Guidelines provide? (Part 3)

[Assistant]
V logical credentials. Such components include biometric elements in the form of fingerprint information and facial imagery and security elements such as electronic keys, certificates, and signatures.
FIPS201 incorporates by reference NIST Special Publication 800-73 (SP80073), which specifies elements related to the PIV card interface, NIST Special Publication 800-76 (SP80076), which specifies the biometric requirements, and NIST Special Publication 800-78 (SP80078) which specifies acceptable cryptographic algorithms and key sizes for PIV systems. A robust testing framework and guidance to provide assurance that a particular component or system is compliant with FIPS201 and supporting standards should exist to build the necessary PIV infrastructure to support common unified processes and systems for government-wide use. NIST developed test guidance in two parts. The first part addresses test requirements for interface to the PIV card and are provided in SP80085A. The second part provides test requirements for the PIV data model and is provided in this document. This document specifies the derived test requirements, and the detailed test assertions and conformance tests for testing the PIV data model. ## Table of Contents

| 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Research Report_ User Perceptions of Smart Home Privacy and Security:

3.2.1                                                    | Audio and Video Access                                   | 12              |
|                                                          | 3. 3.2.10                                                   | Other Security Concerns                                  | 19              |
|                                                          | 3. 3.2.12                                                   | Risk Acceptance                                          | 20              |
| 3.

Research Report_ User Perceptions of Smart Home Privacy and Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.3 (NIST 3.4.3)?

[Assistant]
According to Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management:

3.4.3 High Baseline Control Allocation Table... 3.4.3 Control Item CM-2(7)(a): BASELINE CONFIGURATION | CONFIGURE SYSTEMS, COMPONENTS, OR DEVICES FOR HIGH-RISK AREAS

## Control Item Text:

The organization:

- (a) Issues [Assignment: organization-defined systems, system components, or devices] with [Assignment: organizationdefined configurations] to individuals traveling to locations that the organization deems to be of significant risk. 3.4.3 High Baseline Control Allocation Table

Table 10: High Baseline Control (Item) Allocation Table

|   Impact Level | Determination Statement ID   | Implemented By   | Assessment Boundary   | Assessment Responsibility   | Assessment Methods   | Selected   | Rationale for Risk Acceptance   | Frequency of Assessment   | Impact of not implementing   |
|----------------|------------------------------|------------------|-----------------------|-----------------------------|----------------------|------------|---------------------------------|---------------------------|------------------------------|
|              3 | CM-3(1)(a)(1) DSM            |                  | ISCM-TN               | ISCM-Sys                    | Test                 |            |                                 |                           |                              |
|              3 | CM-3(1)(b)(1)                | ISCM-Sys         | ISCM-TN               | ISCM-Sys                    | Test                 |            |                                 |                           |                              |
|              3 | CM-3(1)(c)(1)                | ISCM-Sys         | ISCM-TN               | ISCM-Sys                    | Test                 |            |                                 |                           |                              |
|              3 | CM-3(1)(d)(1)                | ISCM-Sys         | ISCM-TN               | ISCM-Sys                    | Test                 |            |                                 |                           |                              |
|              3 | CM-3(1)(e)(1)                | ISCM-Sys         | TBD                   | MAN                         | TBD                  |            |                                 |                           |                              |
|              3 | CM-3(1)(f)(1)                | ISCM-Sys         | ISCM-TN               | ISCM-Sys                    | Test                 |            |                                 |                           |                              |
|              3 | CM-8(2)(1)                   | ISCM-Sys         | ISCM-TN               | ISCM-Sys                    | Test                 |            |                                 |                           |                              |
|              3 | MA-3(3)(a)(1)                | DM               | ISCM-TN               | ISCM-Sys                    | Test                 |            |                                 |                           |                              |
|              3 | MA-3(3)(b)(1)                | DM               | ISCM-TN               | ISCM-Sys                    | Test                 |            |                                 |                           |                              |
|              3 | SA-12(1)                     | DSM              | ISCM-TN               | ISCM-Sys                    | Test                 |            |                                 |                           |                              |

AUTOMATION SUPPORT FOR SECURITY ASSESSMENTS: HWAM

## Appendix A.

Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide to Information Technology Security Services:

-  SP 800-30: Risk Management Guide for Information Technology Systems -  SP 800-32: Introduction to Public Key Technology and the Federal PKI Infrastructure -  SP 800-33: Underlying Technical Models for Information Technology Security -  SP 800-34: Contingency Planning for Information Technology Systems -  SP 800-41: An Introduction to Firewalls and Firewall Policy -  SP 800-42: Guideline on Network Security Testing -  SP 800-48: Wireless Network Security: 802.11, Bluetooth, and Handheld Devices -  SP 800-50: Building an Information Technology Security Awareness and Training Program -  SP 800-53: Recommended Security Controls for Federal Information Systems | Types | of Services.............................................................................................................5-1 | of Services.............................................................................................................5-1 | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 5.1 | | Management Security Services ...............................................................................5-2 | | | 5.1.1 | IT Security Program Development ...............................................................5-2 | | | 5.1.2 | IT Security Policy..........................................................................................5-3 | | | 5.1.3 | Risk Management ........................................................................................5-4 | | | 5.1.4 | IT Security Architecture ................................................................................5-4 | | | 5.1.5 | Certification and Accreditation......................................................................5-4 | | | 5.1.6 | IT Security Product Evaluation.....................................................................5-5 | | 5.2 | Operational Security Services..................................................................................5-6 | Operational Security Services..................................................................................5-6 | | | 5.2.1 | Contingency Planning ..................................................................................5-6 | | | 5.2.2 | Incident Handling..........................................................................................5-7 | |

Guide to Information Technology Security Services


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Report of the NSF_NIST Workshop on NSFNET_NREN Security, July 6-7, 1992:

- Establish configuration control for security purposes (Priority A).
- -Supercomputer sites are high priority.
- -Distribute/support use of automated security management tools (e.g. COPS).
- Establish a security perimeter protection capability (Priority B) (e.g. filters, control gateways, Simple Network Management Protocol (SNMP)).
- Establish security audit information collection and review capability (Priority B).

1. use of stronger methods to tighten access controls, ranging from more rigorous administration of passwords to automated mechanisms such as token-based systems, one-time passwords, and perhaps smart cards;
2. use of front-end filters for cost-effective perimeter control, e.g. routers with access control lists, specialized gateways and front-end boxes;
3. use of audit trails with logs of relevant security events;
4. use of tools for storage of information in tamper-resistant ways;

The ASACS authentication sequence for logging onto a machine with a R/W can be implemented in a number of different ways. In the NIST approach, the host machine would first reset the card and then prompt the user for the PIN which has to be sent to the card. The user is authenticated to the card by entering the correct PIN, either through the keypad on the portable R/W or on a keyboard via the host machine. The former path is considered more secure. The card sends back an authentication number that the user can look at to determine whether it is the the right card. This is not considered a strong security mechanism it is similar to writing your name on a card and having it embossed.

Report of the NSF_NIST Workshop on NSFNET_NREN Security, July 6-7, 1992


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to A Framework for Designing Cryptographic Key Management Systems:

key or key pair and whose identifier is associated with a cryptographic key or key pair. For publicprivate  key  pairs,  the  association  is  typically  established  through  a  registration process.
A symmetric key may have a single specific owner, or multiple owners may share the key. - g) CKMS User: CKMS users utilize the CKMS when key management functions are required to support an application. CKMS users may be, and often are, key owners.

A Framework for Designing Cryptographic Key Management Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 1 requirements?

[Assistant]
According to IoT Device Cybersecurity Capability Core Baseline:

## NISTIR 8259A

## IoT Device Cybersecurity Capability Core Baseline

Michael Fagan Katerina N. Megas Karen Scarfone Matthew Smith

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259A

<!-- image -->

## NISTIR 8259A

## IoT Device Cybersecurity Capability Core Baseline

Michael Fagan Katerina N. Megas Applied Cybersecurity Division Information Technology Laboratory

Karen Scarfone Scarfone Cybersecurity Clifton, VA

Matthew Smith Huntington Ingalls Industries Annapolis Junction, MD

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259A

May 2020

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

## National Institute of Standards and Technology Interagency or Internal Report 8259A 23 pages (May 2020)

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259A

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

IoT Device Cybersecurity Capability Core Baseline


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guide to Computer Security Log Management:

| Authority................................................................................................................
| 1-1       |
|                                                                                | 1.2                                                                                | Purpose and Scope............................................................................................... | 1-1       |
|                                                                                | 1.3                                                                                | Audience............................................................................................................... | 1-1       |
|                                                                                | 1.4                                                                                | Publication Structure ............................................................................................. | 1-1       |
| 2. | Introduction                                                                                | to Computer Security Log Management ................................................

Guide to Computer Security Log Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for System and Services Acquisition?

[Assistant]
According to Fiscal Year 2022 Cybersecurity and Privacy Annual Report:

| Cryptography                                | 7   |
|---------------------------------------------|-----|
| Education, Training & Workforce Development | 9   |
| Identity & Access Management                | 11  |
| Privacy                                     | 13  |
| Risk Management & Measurement               | 15  |
| Trustworthy Networks & Platforms            | 17  |
| Usable Cybersecurity                        | 19  |
| NCCoE Summary                               | 21  |
| Opportunities to Engage                     |     |

- The Post-Quantum Cryptography team announced the third-round selection and the fourth-round candidates. The call for additional signatures was released. Standards development on the selected algorithms is underway.
- The Lightweight Cryptography Project continued to evaluate the finalist algorithms to prepare for the final selection. The fifth Lightweight Cryptography Workshop was held.
- NIST's Crypto Publication Review Board completed two reviews, and seven reviews are in progress to update and modernize the portfolio of cryptographic standards.
- NIST continued to explore multi-party threshold cryptography through workshops, calls for feedback on criteria for threshold schemes, and other industry collaboration.

Energizing, promoting, and coordinating the workforce are key priorities for NIST. The National Initiative for Cybersecurity Education (NICE) supports a robust community that works together to advance an integrated ecosystem of cybersecurity education, training, and workforce development.

Fiscal Year 2022 Cybersecurity and Privacy Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Cybersecurity Framework Version 1.1 Manufacturing Profile:

NISTIR 8183 Revision 1 updates the Manufacturing Profile to include the sub-category enhancements established in NIST Framework for Improving Critical Infrastructure Cybersecurity Version 1.1. These updates include managing cybersecurity within the supply chain, self-assessing cybersecurity risk, vulnerability disclosure, system integrity, and more comprehensive controls for identity management. Additional changes include updating language to change references from 'security levels' to 'impact levels.'

Manage cybersecurity risks that could adversely affect the quality of product. Protect against compromise of integrity of the manufacturing process and associated data.

1. The potential impact is LOW if the loss of integrity, availability, or confidentiality could be expected to have a limited adverse effect on manufacturing operations, manufactured product, assets, brand image, finances, personnel, the general public, or the environment.
2. The potential impact is MODERATE if the loss of integrity, availability, or confidentiality could be expected to have a serious adverse effect on manufacturing operations, manufactured product, assets, brand image, finances, personnel, the general public, or the environment.
3. The potential impact is HIGH if the loss of integrity, availability, or confidentiality could be expected to have a severe or catastrophic adverse effect on manufacturing operations, manufactured product, assets, brand image, finances, personnel, the general public, or the environment.

Cybersecurity Framework Version 1.1 Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guide to Storage Encryption Technologies for End User Devices:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure.  ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology.  ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems.  This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations.

The authors, Karen Scarfone and Murugiah Souppaya of the National Institute of Standards and Technology (NIST), and Matt Sexton of Booz Allen Hamilton, wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content.  In particular, their appreciation goes to Tim Grance, Bill Burr, and Tim Polk of NIST, and Derrick Dicoi, Angela Orebaugh, Manuel Villar, Mike Zeberlein, and Mike Zirkle of Booz Allen Hamilton, for their keen and insightful assistance throughout the development of the document.  The authors also appreciate the efforts of those individuals, agencies, and other organizations that contributed input during the public comment period.

Guide to Storage Encryption Technologies for End User Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Computer Security Division 2008 Annual Report:

nd flexible approach for developing security assessment plans containing  assessment  procedures  to  determine  the  effectiveness of  security  controls  deployed  in  federal  information  systems.
Also completed with NIST SP 800-53A, was an initial public draft of webbased assessment cases, which were developed by an interagency team to provide security assessors with online, worked examples identifying specific assessor action steps to accomplish for each of the assessment procedures in SP 800-53A;
- Revision of NIST SP 800-60, which updates the information types used ◆◆ by agencies to develop information system impact levels to help determine the criticality and sensitivity of federal information systems.

Computer Security Division 2008 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to The NIST Definition of Cloud Computing:

Cloud computing is an evolving paradigm. The NIST definition characterizes important aspects of cloud computing and is intended to serve as a means for broad comparisons of cloud services and deployment strategies, and to provide a baseline for discussion from what is cloud computing to how to best use cloud computing.  The service and deployment models defined form a simple taxonomy that is not intended to prescribe or constrain any particular method of deployment, service delivery, or business operation.

Software as a Service (SaaS). The capability provided to the consumer is to use the provider's applications  running  on  a  cloud  infrastructure 2 .  The  applications  are  accessible  from various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even  individual  application  capabilities,  with  the  possible  exception  of  limited  userspecific application configuration settings.

languages, libraries, services, and tools supported by the provider. 3 The consumer does not  manage  or  control  the  underlying  cloud  infrastructure  including  network,  servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.2 (NIST 3.5.2)?

[Assistant]
According to Digital Identity Guidelines:

3.5.2. 3.5.2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Vetting the Security of Mobile Applications:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach  efforts  in  information  system  security,  and  its  collaborative  activities  with  industry, government, and academic organizations. In contrast to static analysis, the most important dynamic analysis requirement is to see the workings of the code as it is being executed. There are two primary ways to obtain this information. First, an executing app can be connected to a remote debugger. Second, the code can be run on an emulator that has built-in debugging capabilities. Running the code on the intended mobile device allows the test tool to select the exact characteristics of the device and can provide a more accurate view about how the app will be behave. On the other hand, an emulator provides more control, especially when the emulator is open-source and can be modified by the evaluator to capture whatever information is needed. Although emulators can simulate different devices, they do not simulate all of them and therefore the simulation may not be completely accurate. Note that malware increasingly detects the use of emulators as a testing platform and changes its behavior accordingly to avoid detection.

Vetting the Security of Mobile Applications